Web3 Security Research

exploits

Injective npm SDK Backdoored to Steal Wallet Keys: Anatomy of a Near Miss

A compromised maintainer account backdoored 18 @injectivelabs npm packages on July 8, 2026, harvesting wallet seed phrases at key-derivation time. It failed by minutes. Here is how it nearly worked.

Dmitry Serdyuk·Jul 14, 2026

3m

exploits

Summer.fi's $6M Lazy Summer Exploit: When a Donation Broke the Vault Math

An attacker donated an asset into a Summer.fi Lazy Summer vault, inflated its totalAssets() share price, and redeemed a flash loan for a $6M profit. No key was stolen. The accounting was the hole.

Dmitry Serdyuk·Jul 8, 2026

4m

exploits

BonkDAO's $20M Governance Takeover: When Buying the Vote Beats Hacking the Code

An attacker spent about $4M buying BONK, took a voting majority on BonkDAO's Realms governance, and passed one proposal that moved $20M out of the treasury. No contract was hacked. The rules were.

Dmitry Serdyuk·Jul 7, 2026

4m

exploits

Aztec Connect's $2.19M Exploit: A ZK-Rollup Settlement Bug in a Contract No One Could Patch

A deprecated Aztec Connect contract was drained of $2.19M when its L1 settlement loop and its ZK proof disagreed on how many slots were real. Its keys were renounced, so no one could pause it.

Dmitry Serdyuk·Jul 5, 2026

4m

exploits

JaredFromSubway MEV Bot Drained for $7.5M in a Counter-MEV Honeypot

JaredFromSubway, Ethereum's most prolific MEV sandwich bot, was drained of $7.5M when an attacker turned its own logic into a counter-MEV honeypot. How the dangling-approval attack worked.

Aron Turner·Jun 23, 2026

3m

research

The Map Already Exists: Building a Digital-Economy Startup in Australia in 2026

Australia ranks 16th on innovation inputs but 27th on outputs. The gap is not talent, it is plumbing. A field guide to the grants, funds and pathways open today, and what to copy from abroad.

Alex Rybalko·Jun 17, 2026

45m

research

Solana Smart Contract Vulnerabilities: The Patterns Behind $500M in Exploits

Wormhole $320M, Mango $114M, Cashio $52M. None of them were Rust bugs. The seven vulnerability classes behind Solana's biggest exploits, and what an audit checks for each.

Alex Rybalko·Jun 12, 2026

3m

exploits

Humanity Protocol's $36M Key Compromise: A Runbook for Wallets That Touch Contracts

One compromised laptop held seven keys and cleared two multisigs, draining $36M+ from Humanity Protocol. A runbook for segregating, monitoring, and revoking project wallets that touch contracts.

Dmitry Serdyuk·Jun 10, 2026

3m

exploits

The $3.2M SquidRouterModule Exploit: How a Public String Drained 86 Safe Wallets

A third-party module named SquidRouterModule drained $3.2M from 86 Gnosis Safe wallets on Ethereum and Base. Full attack chain, the auth flaw, and the lesson.

Aron Turner·May 26, 2026

3m

exploits

GitHub's 3,800-Repo Breach: How a Poisoned VS Code Extension Burned the World's Biggest Code Host

One poisoned VS Code extension on one GitHub employee's laptop cost the company ~3,800 internal repositories. Here is the attack chain, the Mini Shai-Hulud worm internals, and the rotate-everything checklist that follows.

Aron Turner·May 21, 2026

4m

research

Reserve Manipulation Isn't Dead

Seven BSC pools drained $3M in 2026 H1 — same reserve-manipulation primitive every time. Here's what auditors keep missing.

Alex Rybalko·May 20, 2026

2m

research

Audit the Release Pipeline Like a Smart Contract

Your contracts are audited. Your release pipeline isn't. Mini Shai-Hulud proved npm provenance signs whatever a compromised workflow ships. Here's the checklist Web3 teams should run on their own pipeline.

Dmitry Serdyuk·May 19, 2026

3m

research

Copy Fail: When a Linux Bug Becomes Protocol Risk

Copy Fail is a Linux kernel privilege escalation, not a smart contract bug. For Web3 teams running validators, CI runners, deployer hosts, and signing infrastructure, that's exactly why it matters.

Dmitry Serdyuk·May 5, 2026

3m

exploits

Kelp DAO's $292M Hack and Aave's $6B Fallout: One Config Parameter Broke DeFi

A 1-of-1 LayerZero DVN let attackers drain 116,500 rsETH ($292M) from Kelp DAO, loop it through Aave V3 for $266M in ETH, and wipe $6B in Aave TVL in 24 hours. No Solidity bug. One config parameter broke DeFi.

Aron Turner·Apr 20, 2026

4m

case-studies

The Delve Scandal: How a $300M Compliance Startup Sold Fake SOC 2 Reports and Got Expelled from YC

YC expelled Delve after an investigation revealed 493 of 494 SOC 2 reports were identical boilerplate. Here's the full breakdown of the $300M compliance fraud.

Alex Rybalko·Apr 9, 2026

3m

exploits

Drift Protocol's $270M Exploit: How Solana's Durable Nonces Became a Social Engineering Weapon

An attacker drained $270M from Drift Protocol by abusing Solana's durable nonce feature to pre-sign malicious multisig transactions weeks before execution.

Aron Turner·Apr 3, 2026

3m

industry

How to Choose a Smart Contract Audit Firm Without Getting Burned

A framework for evaluating audit firms based on methodology, track record, and specialization, not marketing. What to look for, what to avoid, and the questions most teams forget to ask.

Kolin Cunningham·Mar 20, 2026

3m

technical

Smart Contract Audit Checklist: What to Prepare Before Your Engagement

The preparation checklist that separates smooth audit engagements from costly delays. What your team needs to have ready before auditors touch your code.

Dmitry Serdyuk·Mar 20, 2026

3m

industry

What Does a Smart Contract Audit Actually Cost in 2026

Real audit pricing data from 2026. What affects cost, what you should expect to pay, and how to evaluate whether an audit is worth the investment for your protocol.

Aron Turner·Mar 20, 2026

3m

research

Claude Code Security vs Codex Security: What Each AI Vulnerability Scanner Actually Delivers

Anthropic and OpenAI both shipped AI-powered vulnerability scanners in early 2026. We break down what each tool actually does, where they fall short, and why neither one replaces a smart contract audit.

Dmitry Serdyuk·Mar 18, 2026

4m

exploits

Aave's $27M Liquidation Incident: How a Stale Oracle Parameter Wiped Out 34 Users

A desynchronized oracle parameter caused Aave to undervalue wstETH by 2.85%, triggering $27M in wrongful liquidations across 34 users. Full technical breakdown.

Aron Turner·Mar 12, 2026

3m

industry

What to Expect From a Smart Contract Audit Report

What a professional audit report actually contains, how findings are classified, and how to use the report to ship secure code, not just check a compliance box.

Aron Turner·Mar 10, 2026

3m

research

AI's Growing Role in Auditing and Cybersecurity

With smart contract deployments hitting a record 8.7M per quarter, manual review can't keep up. Discover why AI-assisted auditing is the only realistic way to close the Web3 security gap.

Aron Turner·Mar 2, 2026

3m

research

The Human Factor: Why Web3's Biggest Threat in 2026 Isn't Bad Code — It's People

In 2025, social engineering drove 55% ($1.39B) of crypto losses. As attackers pivot from smart contracts to phishing, learn why true Web3 security requires more than just code audits.

Kolin Cunningham·Feb 26, 2026

3m

research

What $10.77 Billion in Hacks Reveals About Audit Effectiveness

Analysis of 100 largest protocol hacks totaling $10.77B. Only 20% were audited, but the ones that were share a pattern. Firm comparison, verified exploit data, pricing, and evaluation criteria.

Alex Rybalko·Feb 25, 2026

3m